PT-2022-27865

Name of the Vulnerable Software and Affected Versions Apache Airflow Hive Provider versions prior to 5.0.0 Description The issue is related to an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache Airflow Hive Provider. This vulnerability...

PT-2022-27873 · Tp Link · Tp-Link Tl-Wa7510N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WA7510N version 3.12.6 and earlier Description: An issue in the firmware update process allows attackers to execute arbitrary code or cause a Denial of Service DoS via uploading a crafted firmware image. Recommendations: For TP-Lin...

PT-2022-25656 · WordPress · Wholesale Market For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Wholesale Market for WooCommerce WordPress plugin versions prior to 1.0.7 Description: The issue allows unauthenticated attackers to download arbitrary files from the server due to the lack of authorization checks and validation of user...

PT-2022-16064 · Unknown · Silverware Games

Name of the Vulnerable Software and Affected Versions: Silverware Games versions prior to 1.1.34 Description: The issue concerns a social network where users can play games online and attach URLs to YouTube videos. When a post is published, the site generates a related . Although the handler has...

PT-2022-26673 · Autodesk · Autodesk Maya

Name of the Vulnerable Software and Affected Versions: Autodesk Maya versions 2022 through 2023 Description: Parsing a maliciously crafted X B and PRT file can force Autodesk Maya to read beyond allocated buffer. This issue, in conjunction with other vulnerabilities, could lead to code execution ...

PT-2022-24982 · WordPress · Directorist

Name of the Vulnerable Software and Affected Versions: Directorist WordPress plugin versions prior to 7.4.4 Description: The issue allows users with low privileges, such as subscribers, to access sensitive system information. This is due to the lack of proper access controls in the Directorist...

nodejs:16 security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

PT-2022-26622 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.2 iPadOS versions prior to 16.2 Description: The issue was addressed with improved memory handling. An app may be able to break out of its sandbox. Recommendations: For iOS versions prior to 16.2, update to iOS 16.2 o...

CVE-2022-23527 Open Redirect in oidc_validate_redirect_url()

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidcvalidateredirecturl does not properly check fo...

SUSE-SU-2022:4442-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: spacewalk-java: - Version 4.2.44-1 Do not disclose Proxy password in browser console log. bsc1205339 spacewalk-web: - Version 4.2.31-1 Do not log Proxy password in browser console log. bsc1205339 susemanager-sync-data: - Version 4.2.14-1 Add SUSE Linux...

SUSE-SU-2022:4439-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-boynux-squidexporter: - Exclude s390 architecture - Enhanced to build on Enterprise Linux 8 grafana: - Version update from 8.3.10 to 8.5.13 jscPED-2145 - Security fixes: CVE-2022-36062: bsc1203596 CVE-2022-35957: bsc1203597 CVE-2022-31107:...

PT-2022-5957 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.14 and earlier Description: The issue exists due to inadequate protection of the web page structure. It may allow a remote attacker to perform cross-site scripting attacks using a specially crafted link i...

PT-2022-27836 · Siemens · Scalance X204Rna Eec +1

Name of the Vulnerable Software and Affected Versions: SCALANCE X204RNA HSR versions prior to V3.2.7 SCALANCE X204RNA PRP versions prior to V3.2.7 SCALANCE X204RNA EEC HSR versions prior to V3.2.7 SCALANCE X204RNA EEC PRP versions prior to V3.2.7 SCALANCE X204RNA EEC PRP/HSR versions prior to...

PT-2022-6392 · Schneider Electric · Apc Easy Ups Online Monitoring +1

Name of the Vulnerable Software and Affected Versions: APC Easy UPS Online Monitoring Software versions prior to V2.5-GA APC Easy UPS Online Monitoring Software versions prior to V2.5-GA-01-22261 Schneider Electric Easy UPS Online Monitoring Software versions prior to V2.5-GS Schneider Electric...

PT-2022-25007 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express WordPress plugin versions prior to 5.5.1 Description: The issue arises from improper sanitization and escaping of a parameter used in a SQL statement, resulting in a SQL injection that can be exploited by any authenticated use...

PT-2022-24743 · WordPress · User Registration

Name of the Vulnerable Software and Affected Versions: User Registration WordPress plugin versions prior to 2.2.4.1 Description: The issue concerns the improper restriction of file uploads via an AJAX action, which is accessible to both unauthenticated and authenticated users. This could allow...

PT-2022-25774 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS Java HTTP Provider Service version 7.50 Description: The issue is caused by insufficient input validation, allowing an unauthenticated attacker to inject a script into a web request header. Successful exploitation enables an...

PT-2022-24918 · WordPress · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce WordPress plugin versions prior to 2.8.4 Description: The issue allows any authenticated users to perform Stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of some parameters. Recommendations:...

PT-2022-27120 · Unknown · Nuxt/Framework

Name of the Vulnerable Software and Affected Versions: nuxt/framework versions prior to 3.0.0-rc.13 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to sensitive data or...

CVE-2022-23497 Insecure file access in FreshRSS

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords brypt with cost 9, salted of FreshRSS Web interface. If the API is used, the configuration might contain a...